Take all of the users out of the Domain Admins group.
They shouldn't be in there and their BlackBerry devices will eventually fail.

A BlackBerry user shouldn't be a Domain Admin. This is going to muck up the Send As privilieges which BES needs to properly send mail.
Follow the principle of least privilege and make those users "normal" unprivileged users.

Create a separate AD account for your admins and have them use the second account when they need to do work which requires administrative privileges.